topic Re: Charting the 2 fields on the same chart. in Splunk Search

Charting the 2 fields on the same chart.

justinfranks — Mon, 12 May 2014 01:44:44 GMT

I have a log of login timestamps. I would like to display the total count and total unique value count on the same bar chart.

Here is my search:

sourcetype="etv" cname="*" ur="*" | stats dc(u) as "unique", count by u | chart sum(count) as "Total Logins", sum(unique) as "Total Unique Logins"

Where 'u' is the UserID.

However, this search charts the "Total Logins" by "Total Unique Logins", which is not what I want.

Is there a way chart this information, split by their field names?

Re: Charting the 2 fields on the same chart.

lguinn2 — Mon, 12 May 2014 04:28:36 GMT

sourcetype="etv" cname="*" ur="*" 
| stats dc(u) as "unique", count by u 
| stats sum(count) as "Total Logins", sum(unique) as "Total Unique Logins"

should work

Re: Charting the 2 fields on the same chart.

rsennett_splunk — Mon, 12 May 2014 04:36:38 GMT

Incidentally... Depending on the difference between total logins and unique logins, you may need to set the y-axis to "log" rather than "linear" in order to see the relationship between them.

Re: Charting the 2 fields on the same chart.

justinfranks — Mon, 12 May 2014 23:52:48 GMT

I thought so too but here is what I get:

http://i.imgur.com/UR0dLKB.png

However, I'd like to have them on different bars of the count on the bottom.

Re: Charting the 2 fields on the same chart.

lguinn2 — Tue, 13 May 2014 21:19:32 GMT

Would this work

sourcetype="etv" cname="*" ur="*" 
| stats dc(u) as "Total Unique Logins" count as "Total Logins"
| transpose

And then choose the Visualization tab

(After some thought, I figured out that you can simplify your calculations.)

Re: Charting the 2 fields on the same chart.

justinfranks — Tue, 13 May 2014 22:36:10 GMT

Thanks! The transpose command was what I was missing.